The patch bill arrives, and BoA's 1,000 contractors set the price

The exploitability-ranked queue has very little room left. Nucleus, Check Point, CrowdStrike, Synack and the newer remediation agents like Cogent and Reclaim all sell the "1,400 down to 50" story. CISA BOD 26-04 has also made exploitability-based ranking a compliance checkbox, which favors incumbents that already own the scanner and asset data. A new entrant would need a distinctly better exposure signal to compete there. The patch impact simulator is the more open idea. Today, testing before rollout means pilot rings (Ivanti, SecPod), checks the vendor runs on its own side (Adaptiva), or scripted app tests (Rimo3). Replaying captured production traffic against patched builds exists in research and in-house tools like PayU's ProdCast, but nobody I found sells it as a patch approval product for IT ops. The hard parts are real: capturing traffic for vendor-shipped line-of-business apps (Epic, core banking systems) rather than in-house code, stubbing calls that would hit outside systems, and handling PHI and PCI data in the replayed traffic. Those same hard parts are the moat. A focused entrant that proves "patch approved, no regression" evidence for a few regulated app stacks in hospitals and banks could win before Cogent-style agents or the patch vendors add it. Expect it to end up as an acquisition target for them rather than a standalone platform.

• Cogent Security

  Raised a $42M Series A led by Bain Capital in February 2026. It builds AI agents aimed at the gap between finding vulnerabilities and fixing them, and the agents track remediation and confirm that patches are in place. This matches the core thesis almost exactly.

• Reclaim Security

  Raised a $20M Series A from Acrew to automate cyber remediation, moving teams from identifying weaknesses to fixing them.

• Tolmo (YC)

  YC company whose agents triage issues, verify impact and remediate on their own, escalating to humans only when needed.

• Aikido Security (with Root.io)

  Launched agentic pentesting and fix validation in 2026, then bought Root.io, which supplies patched dependencies and container images without forcing major upgrades. The focus is on code and containers, not enterprise IT patching.

• Nucleus Security

  Exposure management platform that ranks vulnerabilities by exploitability and business context rather than CVSS. Competes directly with the ranked patch queue.

• Check Point Exposure Management

  Combines prioritization with exploitability validation, and markets itself on the claim that fewer than 1 in 12 critical vulnerabilities need urgent action. That is the same pitch as cutting 1,400 items down to 50.

• CrowdStrike Falcon Exposure Management

  Large-vendor feature that uses adversary intelligence to rank exploitable exposures and drive fixes.

• Synack (exposure validation)

  Pitches exploitability validation in response to CISA BOD 26-04, which ties remediation deadlines to evidence of exploitation instead of CVSS scores.

• Rimo3

  Automatically tests whether applications still work after patches and updates are applied. This is the closest existing match to the patch impact simulator, though it runs scripted app tests rather than replayed production traffic.

• SecPod Test and Deploy

  Adds a test stage before automated patch jobs. Rollout continues on its own once the customer's success criteria pass on test machines.

• Adaptiva

  Autonomous patching. The vendor tests patches for install, compatibility and clean uninstall before publishing them to its library, but this happens on the vendor's side, not in the customer's environment.

• Ivanti Endpoint Manager / DSM

  Patch rollout projects with pilot rings and dependency or incompatibility checks before wide deployment.

• PayU ProdCast

  In-house tool that replays real production traffic against new code before deploy. It shows the traffic-replay method works, but it is not sold as a patch approval product.

Checked 2026-10-14